CVE-2014-5077

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-01 · updated 2026-06-17
Weakness: CWE-476

Description

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04
Linux kernel: from 2.6.24 before 3.2.63; from 3.3 before 3.4.103; from 3.5 before 3.10.53; from 3.11 before 3.12.27; from 3.13 before 3.14.17; from 3.15 before 3.15.10 — fixed in 3.10.53, 3.12.27, 3.14.17, 3.15.10, 3.2.63, 3.4.103
RedHat Enterprise Linux Eus: 6.5
RedHat Enterprise Linux Server Aus: 6.2, 6.5
RedHat Enterprise Linux Server Tus: 6.5
SUSE Linux Enterprise Server 15 SP1: 11-sp3
SUSE Linux Enterprise Real Time Extension: 11-sp3
SUSE Linux Enterprise Server: 11-sp3

How to fix

Upgrade to a fixed version: Linux kernel 3.10.53, 3.12.27, 3.14.17, 3.15.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-5077 or the next vulnerability affects your stack